git: aa0edb002f51 - stable/14 - ktls CBC decrypt: Avoid creating zero length iovec entries

The branch stable/14 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=aa0edb002f51fde3d81e26013cb497f2f26916ab

commit aa0edb002f51fde3d81e26013cb497f2f26916ab
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-06-30 18:11:29 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-10-08 18:33:09 +0000

    ktls CBC decrypt: Avoid creating zero length iovec entries
    
    If an mbuf's length in the chain for an encrypted TLS record exactly
    matches the remaining length of header bytes to skip, skip the mbuf
    entirely rather than adding a zero-length iovec entry.
    
    Sponsored by:   Chelsio Communications
    
    (cherry picked from commit 1756d1cab3ce28085eec94a45c557e1af265ccd0)
---
 sys/opencrypto/ktls_ocf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c
index 3c8b2e4f4589..64fa3f05941a 100644
--- a/sys/opencrypto/ktls_ocf.c
+++ b/sys/opencrypto/ktls_ocf.c
@@ -504,7 +504,7 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls,
 	iov[0].iov_len = sizeof(ad);
 	skip = sizeof(*hdr) + AES_BLOCK_LEN;
 	for (i = 1, n = m; n != NULL; n = n->m_next) {
-		if (n->m_len < skip) {
+		if (n->m_len <= skip) {
 			skip -= n->m_len;
 			continue;
 		}